Debian Linux vulnerabilities

CVE-2024-26766 [MEDIUM] CWE-193 CVE-2024-26766: In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx->num_des In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx->num_descs off-by-one error Unfortunately the commit `fd8958efe877` introduced another error causing the `descs` array to overflow. This reults in further crashes easily reproducible by `sendmsg` system call. [ 1080.836473] general protection fault, probably

CVE-2024-35958 [MEDIUM] CVE-2024-35958: In the Linux kernel, the following vulnerability has been resolved: net: ena: Fix incorrect descrip In the Linux kernel, the following vulnerability has been resolved: net: ena: Fix incorrect descriptor free behavior ENA has two types of TX queues: - queues which only process TX packets arriving from the network stack - queues which only process TX packets forwarded to it by XDP_REDIRECT or XDP_TX instructions The ena_free_tx_bufs() cycles through all d

CVE-2024-27410 [MEDIUM] CVE-2024-27410: In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject iftype ch In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject iftype change with mesh ID change It's currently possible to change the mesh ID when the interface isn't yet in mesh mode, at the same time as changing it into mesh mode. This leads to an overwrite of data in the wdev->u union for the interface type it currently has,

CVE-2024-26733 [MEDIUM] CWE-787 CVE-2024-26733: In the Linux kernel, the following vulnerability has been resolved: arp: Prevent overflow in arp_re In the Linux kernel, the following vulnerability has been resolved: arp: Prevent overflow in arp_req_get(). syzkaller reported an overflown write in arp_req_get(). [0] When ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour entry and copies neigh->ha to struct arpreq.arp_ha.sa_data. The arp_ha here is struct sockaddr, not struct socka

CVE-2024-26675 [MEDIUM] CWE-770 CVE-2024-26675: In the Linux kernel, the following vulnerability has been resolved: ppp_async: limit MRU to 64K sy In the Linux kernel, the following vulnerability has been resolved: ppp_async: limit MRU to 64K syzbot triggered a warning [1] in __alloc_pages(): WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp) Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K") Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU) [1]: WARNING: C

CVE-2024-26906 [MEDIUM] CVE-2024-26906: In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disallow vsyscall page In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() When trying to use copy_from_kernel_nofault() to read vsyscall page through a bpf program, the following oops was reported: BUG: unable to handle page fault for address: ffffffffff600000 #PF: supervisor read access in kerne

CVE-2023-4132 [MEDIUM] CWE-416 CVE-2023-4132: A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occ A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition.

CVE-2024-35973 [MEDIUM] CWE-908 CVE-2024-35973: In the Linux kernel, the following vulnerability has been resolved: geneve: fix header validation i In the Linux kernel, the following vulnerability has been resolved: geneve: fix header validation in geneve[6]_xmit_skb syzbot is able to trigger an uninit-value in geneve_xmit() [1] Problem : While most ip tunnel helpers (like ip_tunnel_get_dsfield()) uses skb_protocol(skb, true), pskb_inet_may_pull() is only using skb->protocol. If anything els

CVE-2025-38601 [MEDIUM] CWE-909 CVE-2025-38601: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstances: 1) First ath11k_hal_dump_srng_stats() call Last interrupt received for each group: a

CVE-2024-36017 [MEDIUM] CVE-2024-36017: In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLA_ In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a struct ifla_vf_vlan_info so the size of such attribute needs to be at least of sizeof(struct ifla_vf_vlan_info) which is 14 bytes. The current size validatio

CVE-2024-26863 [MEDIUM] CWE-908 CVE-2024-26863: In the Linux kernel, the following vulnerability has been resolved: hsr: Fix uninit-value access in In the Linux kernel, the following vulnerability has been resolved: hsr: Fix uninit-value access in hsr_get_node() KMSAN reported the following uninit-value access issue [1]: BUG: KMSAN: uninit-value in hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246 hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246 fill_frame_info net/hsr/hsr_forward.c:577

CVE-2023-34256 [MEDIUM] CWE-125 CVE-2023-34256: An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the bl

CVE-2024-26935 [MEDIUM] CVE-2024-26935: In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procf In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procfs host directory regression Commit fc663711b944 ("scsi: core: Remove the /proc/scsi/${proc_name} directory earlier") fixed a bug related to modules loading/unloading, by adding a call to scsi_proc_hostdir_rm() on scsi_remove_host(). But that led to a potentia

CVE-2024-26805 [MEDIUM] CWE-908 CVE-2024-26805: In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-af In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter syzbot reported the following uninit-value access issue [1]: netlink_to_full_skb() creates a new `skb` and puts the `skb->data` passed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data size is specified as

CVE-2024-26645 [MEDIUM] CVE-2024-26645: In the Linux kernel, the following vulnerability has been resolved: tracing: Ensure visibility when In the Linux kernel, the following vulnerability has been resolved: tracing: Ensure visibility when inserting an element into tracing_map Running the following two commands in parallel on a multi-processor AArch64 machine can sporadically produce an unexpected warning about duplicate histogram entries: $ while true; do echo hist:key=id.syscall:val=hitcoun

CVE-2025-39848 [MEDIUM] CWE-401 CVE-2025-39848: In the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in In the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d ("net: introduce per netns packet chains"). skb->dev becomes NULL and we crash in __netif_receive_skb_core(). Before above commit, different kind of bugs or

CVE-2025-38491 [MEDIUM] CWE-667 CVE-2025-38491: In the Linux kernel, the following vulnerability has been resolved: mptcp: make fallback action and In the Linux kernel, the following vulnerability has been resolved: mptcp: make fallback action and fallback decision atomic Syzkaller reported the following splat: WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback n

CVE-2025-37949 [MEDIUM] CWE-476 CVE-2025-37949: In the Linux kernel, the following vulnerability has been resolved: xenbus: Use kref to track req l In the Linux kernel, the following vulnerability has been resolved: xenbus: Use kref to track req lifetime Marek reported seeing a NULL pointer fault in the xenbus_thread callstack: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: e030:__wake_up_common+0x4c/0x180 Call Trace: __wake_up_common_lock+0x82/0xd0 process_msg+0x18e/0x2

CVE-2025-38174 [MEDIUM] CVE-2025-38174: In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Do not double dequ In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Do not double dequeue a configuration request Some of our devices crash in tb_cfg_request_dequeue(): general protection fault, probably for non-canonical address 0xdead000000000122 CPU: 6 PID: 91007 Comm: kworker/6:2 Tainted: G U W 6.6.65 RIP: 0010:tb_cfg_request_dequeue+0x2

CVE-2024-36957 [MEDIUM] CWE-193 CVE-2024-36957: In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: avoid off-by-one In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: avoid off-by-one read from userspace We try to access count + 1 byte from userspace with memdup_user(buffer, count + 1). However, the userspace only provides buffer of count bytes and only these count bytes are verified to be okay to access. To ensure the copied buffer